Out-of-bounds Write to API in vim/vim

Vulnerability

An out-of-bounds write vulnerability exists in Vim's diff_mark_adjust_tp() function, which is triggered during diff mode operations when using the dp (diff put) command followed by an undo. The code in diff.c failed to validate that the line offset (off) subtracted from dp->df_lnum[i] would not cause the result to become zero or negative, leading to a write past the allocated buffer. The flaw affects Vim versions prior to 9.0.0100 [1][2].

Exploitation

An attacker must first convince the victim to open a file with diff mode enabled (e.g., by using vim -d or running :set diff). The attacker then needs to craft a sequence of commands in the editor: a diff put (dp) followed by an undo (u) operation. The patch comment notes a "FIXME: somehow this causes a valgrind error when run directly but not when run as a test" indicating the race-like conditions may require a specific file content to trigger the invalid memory access reliably [1]. No special authentication or network position is required beyond delivering the crafted file or command sequence.

Impact

Successful exploitation results in an out-of-bounds write to heap memory. In the worst case, this could allow an attacker to crash Vim or achieve arbitrary code execution in the context of the victim's session. The CVSS score (not provided explicitly) typically ranges 7.8-9.8 for such vulnerabilities; the Huntr bounty listing implies it was considered a high-severity issue [2].

Mitigation

The vulnerability is fixed in Vim 9.0.0100, released on 2022-08-01. The patch adds bounds checking to diff_mark_adjust_tp() by comparing the line number with off before subtracting and setting df_lnum[i] to at least 1 [1]. Users should upgrade to Vim 9.0.0100 or later (9.0.0101 includes additional refinements). No workaround is available; disabling diff mode may reduce exposure but is not a complete fix. The CVE is not listed on CISA KEV.